Privacy is an interdisciplinary concern that involves IT risk management, information security, business continuity and regulatory compliance activities. Yet the analyst firm’s survey of North American, UK and German businesses found that less than half (43%) of organizations have a comprehensive privacy management program in place. A small percentage (7%) even admitted to just "doing the bare minimum" regarding privacy laws.
"More than a third of organizations still 'consider privacy aspects in an ad hoc fashion' and it is surprising that so many companies are saying that they are not conducting privacy impact assessments before major projects”, said Carsten Casper, research vice president at Gartner, in a statement. “62% do not scan websites and applications, or conduct an organization-wide privacy audit every year. Organizations must put these activities on their to-do list for 2014."
In terms of awareness, the survey revealed privacy to be a top-of-mind concern for companies nonetheless, particularly as cloud, mobile, big data and social computing challenges escalate. Most understand that they need effective monitoring of privacy-related performance and suitable adjustments processes and technologies, particularly for data masking, encryption, data storage and document retention.
Those awareness levels are clearly helped along by the high-profile Operation PRISM data collection initiative from the NSA, leaked by Edward Snowden, and accordingly, the handling of personal information for employees, customers and citizens tops the list of requirements respondents believe should be included in a privacy program. Some organizations — concerned about violating domestic privacy laws and the risk to their reputations — do not store personal data in locations where it can be seized by foreign authorities or is at great risk from cyber-attacks.
However, central global storage of personal data is becoming increasingly widespread. For the first time this year, more organizations stored their customer data in a central global place rather than in a regional or local data center, which was the dominant model previously.
The survey found that 38% of organizations transform personal data before transmitting it abroad (with masking, encryption or similar), thus keeping sensitive data local, while allowing some functionality abroad. This is the preferred option compared to domestic storage (29%), remote storage with only local access (27%) and with a focus on legal protection (22%).
"When storing and accessing personal data, organizations face a number of options. They can store data locally or in a low-cost country, allow access to domestic or remote staff, use a provider for application management or for infrastructure management, or implement legal and technical controls, such as data masking, tokenization and encryption," said Casper. "There is no right or wrong answer. Organizations have to decide which type of risk they want to mitigate, how much money they want to spend and how much residual risk they are willing to accept.”
Gartner’s study uncovered that many organizations are looking to boost their privacy activities through increased staffing and budgets to initiate comprehensive privacy programs—but creating the right staffing model is crucial to the long-term success of privacy programs. About 32% of survey respondents said that their organizations have increased privacy-related staff from 2012 to 2013 — the most significant increase since Gartner started its privacy surveys in 2008. And, almost 90% of organizations now have at least one person responsible for privacy.
One caveat however: Casper noted that to be successful, companies must create the role of a privacy officer to shepherd the process and be its champion.
"Gartner's consistent observation is that privacy programs are only successful if someone is driving them,” said Casper. “However, having privacy programs that are owned by [a privacy officer] is still not the norm.”
Only 66% of survey respondents said they have a defined privacy officer role - although the number is as high as 85% in Germany and similar countries where this role is a legal requirement.
Casper added that a privacy officer should have broad expertise and solid relationship management and communication skills, because of the nebulous and often convoluted ways that privacy impacts various areas of an organization. He or she must monitor a variety of (sometimes conflicting) business and IT requirements and collaborate with different internal and external business functions. In larger organizations, privacy officers will not only require a budget and a team, but their success is also dependent on support from senior management.
"Organizations continue to invest more in privacy due to ongoing public attention and a number of new or anticipated legal requirements," said Casper. "They also show that previous investments have not always paid off and that organizations need to refocus their privacy efforts if they want to raise the maturity level of their privacy programs back to that of 2011."
He added, “Once the right team is in place, businesses must prioritize privacy programs as the No. 1 objective.”